Generate SBOMs

[tschmidtb51]

We need a workflow to automatically generate SBOMs for each release for both: SPDX and CycloneDX.

[peinjoh]

SBOM generation for rust projects has been the topic of multiple RFCs (rust-lang/rfcs#2801, rust-lang/rfcs#3553), with the recent RFC 3553 implementation making it to nightly in February 2025.

RFC 3553 concerns the generation of a pre-cursor SBOM though. This pre-cursor still needs to be parsed by an external tool.

There are multiple OSS tools for this. I propose we try out https://github.com/anchore/syft. They also provide ready-made Github Actions to use the tool (https://github.com/anchore/sbom-action) and add the sbom files to the github releases.

Syft can work based on the cargo.lock file. This can be improved by using https://github.com/rust-secure-code/cargo-auditable to embed a dependency tree representation in the compiled binaries, which defines the exact crate versions used. Syft also supports this auditable binary. For context, cargo-auditable is also the direct result of the first RFC 2801.

When RFC 3553 has been it to stable, cargo-auditable also already supports using the pre-cursor format.

Additionally, DevGuard seems like a promising alternative I'd like to explore, as they are also active in the CSAF space and can also export (among others) SPDX and CDX SBOMs.

To summarize, I propose we:

• add cargo-auditable in the build step
• add the syft github automation
• request access to the hosted DevGuard instance and test out the github integration and SBOM export features there

[tziemek]

@tschmidtb51 we tested DevGuard in one of our repositories and it looks quite nice. Could you create an organisation on devguard and install the github app in the csaf github organisation? HowTo for the GitHub App is here github integration.